I suggest, in order to raise further trust and calm the security people :) :) that this project would try to get the action GitHub verified. Currently, what it really, really implies for the project is a bit of mystery, but hopefully N.G.O's should be as ok as non ngo's
s, it most likely involves a bit of security policy practice, example from someone that succeded - https://github.com/orgs/community/discussions/25265#discussioncomment-3247173.

Why is this potentially good? Well, some GitHub organisations have strict security policies - and choosen to tick the "Allow
Allow actions created by GitHub
Allow actions by Marketplace verified creators, and this would make the REUSE action viable for them.

So, it would further raise the trust bar for organizations looking to use the REUSE action in CI pipes.

Note: I'm aware of that the REUSE project is looking to move to other hosting alternatives long term (fsfe/reuse-tool#865). But, Until that happens - and even after, this would still be relevant, as a GitHub Action still might be published).